General

  • Target

    4348bfb9c2e097ab0a281c8e0c0e0005_JaffaCakes118

  • Size

    3.6MB

  • MD5

    4348bfb9c2e097ab0a281c8e0c0e0005

  • SHA1

    41be058bf7e6d1b5050d73e379868faa19d7e8ec

  • SHA256

    2d2fa95ac9f7493185fa305a1cdc915b8b2425825e54db84959c4f8758c2c9b1

  • SHA512

    205432052bc1a4d9f74cd4eeae0f294d474984b1842c47e33351a2321a2a72009621d76760891cc130e80c0aa5140d632f5b13766bcd20bf97460a308ac20ff2

  • SSDEEP

    98304:CReybhUQB9IKA0cR6JC1yxl79QBtxUzHUXIo+HzFCcn0ZgWhn/:WhUQ40cRDYaBtxUzHQInHRCiyg6/

Score
3/10

Malware Config

Signatures

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • 4348bfb9c2e097ab0a281c8e0c0e0005_JaffaCakes118
    .zip
  • CloseApp.dll
    .dll windows:4 windows x86 arch:x86

    def06f6439686b4d106bed2003b68243


    Headers

    Imports

    Exports

    Sections

  • CloseApp2.dll
    .dll windows:4 windows x86 arch:x86

    def06f6439686b4d106bed2003b68243


    Headers

    Imports

    Exports

    Sections

  • ConfigDir_Default.ini
  • ConfigDir_Sample.ini
  • ExtraWebsites.txt
  • Note_For_PortableUse.txt
  • RokuRadioSnooper.ntv.lng
  • URLSnooper.CHS.lng
  • URLSnooper.DEU.lng
  • URLSnooper.FRA.lng
  • URLSnooper.HUN.lng
  • URLSnooper.NTV
  • URLSnooper.dcupdate
    .xml
  • URLSnooper.dcupdateredirect
  • URLSnooper.exe
    .exe windows:4 windows x86 arch:x86

    bcfe28fa367f8ff9f407654528120062


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • URLSnooper.ntv.lng
  • UserWebsites.txt
  • Visit Homepage at DonationCoder.com.url
  • WinPcap_4_0_beta2.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    1221406604d6fef21b4469a58a9cf427


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nxs.dll
    .dll windows:4 windows x86 arch:x86

    de36b53ffe7c2e743efb66087e7ba980


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Packet.dll
    .dll windows:4 windows x86 arch:x86

    2de07d097c07a01b4e03beaefd694ed7


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/WanPacket.dll
    .dll windows:4 windows x86 arch:x86

    c4f10a94feffedd44a2a094b559256d7


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/pthreadVC.dll
    .dll windows:4 windows x86 arch:x86

    90ee61357770484e2d085958b94141a3


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/wpcap.dll
    .dll windows:4 windows x86 arch:x86

    a74f57c0da946efe5b5644f58e3aa02c


    Headers

    Imports

    Exports

    Sections

  • $TEMP/WpBann.htm
    .html
  • WinPcapInstall.dll
    .dll windows:4 windows x86 arch:x86

    d60f1109a9a63e2695e536772cd81b32


    Headers

    Imports

    Exports

    Sections

  • rpcapd.exe
    .exe windows:4 windows x86 arch:x86

    e15cadb5060ea0689a84c75d4e8422a5


    Headers

    Imports

    Sections

  • WinPcap_4_1_3.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bootOptions.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/Packet.dll
    .dll windows:4 windows x86 arch:x86

    19fa7010cacd16ef346ea8bbc2e8b999


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/pthreadVC.dll
    .dll windows:4 windows x86 arch:x86

    90ee61357770484e2d085958b94141a3


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/wpcap.dll
    .dll windows:4 windows x86 arch:x86

    10dce091d63eed72dc0010ebc8838f6a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WinPcapInstall.dll
    .dll windows:4 windows x86 arch:x86

    ad1fff2efc5a1aa2884d5c780a51aa99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • rpcapd.exe
    .exe windows:4 windows x86 arch:x86

    2b9e73ff502840fe6b381682c42d43cf


    Code Sign

    Headers

    Imports

    Sections

  • postinstall.txt
  • preinstall.txt
  • urlsnooper.chm
    .chm